Acronis: Acronis True Image Local Privilege Escalation Due To Race Condition In Application Verification

Summary The Acronis True Image application has a SUID binary "Acronis True Image" that starts another binary "console" in the same directory. The SUID binary does some checks on "console" before it is run to make sure the correct binary is being run. By using a hardlink to the SUID binary we can...

Acronis True Image has an unspecified vulnerability

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a security vulnerability that could be exploited by an attacker to add arbitrary malicious executables to a whitelist or even exclude an entire dri...

Acronis True Image Denial of Service Vulnerability

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a denial of service vulnerability that stems from the program's logs being generated in a predictable pattern, allowing a non-privileged user to...

CVE-2020-9451

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a not yet created log file to...

CVE-2020-9451

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a not yet created log file to...

CVE-2020-9452

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine...

CVE-2020-9452

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine...

CVE-2020-9450

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to antiransomwareservice.exe. This can be exploited to add an arbitrary malicious...

CVE-2020-9450

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to antiransomwareservice.exe. This can be exploited to add an arbitrary malicious...

Default credentials

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine...

Code injection

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to antiransomwareservice.exe. This can be exploited to add an arbitrary malicious...

Design/Logic Flaw

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a not yet created log file to...

CVE-2020-9452

CVE-2020-9452 affects Acronis True Image 2020 (v24.5.22510). The issue resides in anti_ransomware_service.exe’s quarantine functionality, which can copy a suspected ransomware file between directories with SYSTEM privileges. Unprivileged users have write access in the quarantine folder, enabling ...

CVE-2020-9452

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine...

CVE-2020-9450

Affected product: Acronis True Image 2020 (build 24.5.22510). The issue lies in anti_ransomware_service.exe, whose REST API is exposed for GUI communication and is accessible to unprivileged users. This allows adding arbitrary executables to the whitelist or excluding an entire drive from monitor...

CVE-2020-9450

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to antiransomwareservice.exe. This can be exploited to add an arbitrary malicious...

CVE-2020-9451

CVE-2020-9451 affects Acronis True Image 2020 (v24.5.22510). The issue arises in anti_ransomware_service.exe, which logs to a folder writable by unprivileged users. Logs are created in a predictable pattern, enabling an unprivileged user to create a hardlink from a not-yet-created log file to ant...

CVE-2020-9451

An issue was discovered in Acronis True Image 2020 24.5.22510. antiransomwareservice.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a not yet created log file to...

Acronis True Image 安全漏洞

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a denial of service vulnerability that stems from the program's logs being generated in a predictable pattern, allowing a non-privileged user to...

Acronis True Image 安全漏洞

Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. Acronis True Image 2020 version 24.5.22510 contains a security vulnerability that could be exploited by an attacker to add arbitrary malicious executables to a whitelist or even exclude an entire dri...